PT-2025-36568 · Plex+1 · Plex Media Server+1

D-Xuan · Published 2025-09-09 · Updated 2025-09-09 · CVE-2025-58761

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Tautulli versions prior to 2.16.0

Description: Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The real pms image proxy endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. The image to be fetched is specified through the img URL parameter, which can be bypassed by adjoining path traversal characters to reach files outside of intended directories. An attacker can exfiltrate files on the application file system, including the tautulli.db SQLite database and the config.ini file. Obtaining the admin password or a valid JWT token allows an unauthenticated attacker to escalate privileges to gain administrative control over the application.

Recommendations: Update Tautulli to version 2.16.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-27

Related Identifiers

CVE-2025-58761

GHSA-R732-M675-WJ7W

Affected Products

Plex Media Server

Tautulli

References · 8

• 🔥 https://github.com/Tautulli/Tautulli/security/advisories/GHSA-r732-m675-wj7w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58761.json · Exploit
• https://github.com/Tautulli/Tautulli/commit/ec77a70aafc555e1aad0d9981f719d1200c117f1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-58761 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58761 · Vendor Advisory
• https://t.me/CVEtracker/32115 · Telegram Post
• https://reddit.com/r/Tautulli/comments/1nc5wew/important_security_update_20250908 · Reddit Post
• https://twitter.com/CVEnew/status/1965509598884037102 · Twitter Post